check out the "Hardening DotNetNuke Security" Guidelines available here: http://www.dotnetnuke.com/News/SecurityBulletins/Policy/tabid/940/Default.aspx

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

When I setup my folder permissions I grant full permissions ONLY to the NETWORK SERVICE (or ASPNET) accounts, I do not give the I_USER accounts full access.

From a security standpoint from my knowledge this isn't that big of an issue as the NETWORK SERVICE account is the working process for DNN, the application is then incharge of not doing things it shouldn't do.

Could you get buy with only granting full permissions to specific folders?  Possibly, but for the most part there are so many that you need to that I would recommend just leaving it at all!

THis is just my two cents on this topic....Cathal or some of the other more expert security people might have something else to say. 

I would however in your case remove the access for the anonymous user account.

---

-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.


Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services